Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

OTRS was prone to multiple SQL-injection vulnerabilities which could allow remote authenticated attackers to execute arbitrary SQL code via unspecified vectors.(CVE-2010-0438).

It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise input data that is used on SQL queries, which might be used to inject arbitrary SQL to, for example, escalate privileges on a system that uses otrs2.

The oldstable distribution (etch) is not affected.

The remote web server is hosting OTRS, an Open source Ticket Request System written in Perl.  The installed version is earlier than 2.1.9, 2.2.9, 2.3.5, or 2.4.7.  Such versions are potentially affected by multiple unspecified sql-injection vulnerabilities.  An attacker, with a valid Agent or Customer-session, could exploit this flaw to read or modify records in the database.

OTRS Security Advisory reports :

Missing security quoting for SQL statements allows agents and customers to manipulate SQL queries. So it's possible for authenticated users to inject SQL queries via string manipulation of statements.

A malicious user may be able to manipulate SQL queries to read or modify records in the database. This way it could also be possible to get access to more permissions (e. g. administrator permissions).

To use this vulnerability the malicious user needs to have a valid Agent- or Customer-session.

ID	Name	Product	Family	Type	Severity
47732	openSUSE Security Update : otrs (openSUSE-SU-2010:0366-1)	Nessus	SuSE Local Security Checks	Local	medium
47729	openSUSE Security Update : otrs (openSUSE-SU-2010:0366-1)	Nessus	SuSE Local Security Checks	Local	medium
47726	openSUSE Security Update : otrs (openSUSE-SU-2010:0366-1)	Nessus	SuSE Local Security Checks	Local	medium
44857	Debian DSA-1993-1 : otrs2 - sql injection	Nessus	Debian Local Security Checks	Local	medium
5334	OTRS Core System Multiple Unspecified SQL Injection Vulnerabilities	Nessus Network Monitor	CGI		high
44407	FreeBSD : otrs -- SQL injection (6b575419-14cf-11df-a628-001517351c22)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2010-0438

high

Tenable Plugins

medium

medium

medium

medium

high

medium